Vehicle program update management system, reprogramming terminal, and vehicle program update management method

ABSTRACT

A vehicle program update management system includes a first server configured to manage a program configuration which is a combination of a plurality of programs, a second server configured to manage a plurality of update programs for the plurality of programs, and a reprogramming terminal which is a device that is wiredly connected to the plurality of control devices to perform information processing for updating the programs.

INCORPORATION BY REFERENCE

The present application claims priority under 35 U.S.C. § 119 toJapanese Patent Application No. 2021-052603 filed on Mar. 26, 2021. Thecontent of the application is incorporated herein by reference in itsentirety.

BACKGROUND OF THE INVENTION Field of the Invention

The present invention relates to a vehicle program update managementsystem that manages program updates for an electronic control unitmounted on a vehicle, a reprogramming terminal, and a vehicle programupdate management method.

Description of the Related Art

In recent years, a movement to make vehicles “connected” is progressingin which a vehicle is connected to a network utilizing a wirelesstechnology. In such “connected” vehicles, comfortable operation such asautonomous driving is expected in the future, whereas a security risk inwhich a vehicle is attacked through a network is increasing. Manyelectronic control units are used for a current vehicle, and programs(software) for controlling the electronic control units require updatesinvolving addition or correction of functions. Since the updatemanagement for the programs is directly related to the user's safety,the update management is to be subjected to the regulation by the lawsbased on the international standards. In the regulation, thorough updatemanagement for the program is required, and the update historymanagement is required for both cases of when the program is updatedthrough a wired connection and when the program is updated through awireless connection.

Japanese Patent Laid-Open No. 2020-96321 discloses a technique fordetermining whether an update device to be connected to a vehicle isauthenticated even outside the network range, in order to preventrewriting of a program by ill-intentioned third parties. However, ifthere is any possibility that a program or a rewriting command of theprogram is stolen from the update device and altered even when theupdate device is authenticated, it is difficult to protect the securityof a vehicle. The program for the control device of the vehicle has beenupdated conventionally and uniformly by distributing, to a vendor or adealer that performs update work of the program, a recording medium suchas a compact disc read only memory (CD-ROM) in which an update programis recorded, but in the case where each vehicle performs program updateusing a wireless connection, there occurs a difference in program updatehistory for a plurality of control devices of each vehicle, which isunsuitable for a uniform program update.

The present invention is made in the light of the above-describedbackground, and has an object to provide a vehicle program updatemanagement device that manages program update for a plurality of controldevices mounted on a vehicle, a reprogramming terminal, and a programupdate management method.

SUMMARY OF THE INVENTION

An inventive aspect to achieve the object described above provides avehicle program update management system that performs update managementfor a plurality of programs stored in and executed by each of aplurality of control devices mounted on a vehicle, the vehicle programupdate management system including a first server configured to manage aprogram configuration which is a combination of the plurality ofprograms, a second server configured to manage a plurality of updateprograms for the plurality of programs, and a reprogramming terminalwhich is a device that is wiredly connected to the plurality of controldevices to perform information processing for updating the programs,wherein the reprogramming terminal includes an update informationacquisition unit configured to acquire, from the vehicle, updateinformation about the plurality of programs installed into each of theplurality of control devices mounted on the vehicle, the first serverincludes a determination unit configured to determine the programconfiguration necessary for the vehicle based on the update information,a reprogramming information generation unit configured to generatereprogramming information which is information about the update programsnecessary for the vehicle, based on the determination, and an installcommand generation unit configured to generate install commandinformation which is information about a command for installing theupdate programs into the plurality of control devices, and thereprogramming terminal further includes an update program acquisitionunit configured to acquire the plurality of update programs from thesecond server based on the reprogramming information, a commandacquisition unit configured to acquire the install command information,and a writing unit configured to write the acquired plurality of updateprograms into each of the plurality of control devices based on theinstall command information.

The above-described vehicle program update management system may have aconfiguration in which at least one of the program configuration, theupdate program, and the install command information is stored in avolatile storage unit included in the reprogramming terminal and is notstored in a nonvolatile storage unit included in the reprogrammingterminal.

Another inventive aspect to achieve the object described above providesa reprogramming terminal which is a device that is wiredly connected toa plurality of control devices mounted on a vehicle to performinformation processing for updating a plurality of programs stored inand executed by each of the plurality of control devices, thereprogramming terminal including an update information acquisition unitconfigured to acquire update information about the plurality of programsinstalled into each of the plurality of control devices, an updateprogram acquisition unit configured to acquire a plurality of updateprograms from a second server that manages the plurality of updateprograms for the plurality of programs, a command acquisition unitconfigured to acquire, from a first server, install command informationabout a command for installing the update programs into the plurality ofcontrol devices, the first server managing a program configuration whichis a combination of the plurality of programs, and a writing unitconfigured to write the acquired plurality of update programs into eachof the plurality of control devices based on the install commandinformation.

Another inventive aspect to achieve the object described above providesa vehicle program update management method that performs updatemanagement for a plurality of programs stored in and executed by each ofa plurality of control devices mounted on a vehicle, the methodincluding a first step of managing a program configuration which is acombination of the plurality of programs, a second step of managing aplurality of update programs for the plurality of programs, and areprogramming step of causing a device wiredly connected to theplurality of control devices to perform information processing forupdating the programs, wherein the reprogramming step includes an updateinformation acquisition step of acquiring, from the vehicle, updateinformation about the plurality of programs installed into each of theplurality of control devices mounted on the vehicle, the first stepincludes a determination step of determining the program configurationnecessary for the vehicle based on the update information, areprogramming information generation step of generating reprogramminginformation which is information about the update programs necessary forthe vehicle, based on the determination, and an install commandgeneration step of generating install command information which isinformation about a command for installing the update programs into theplurality of control devices, and the reprogramming step furtherincludes an update program acquisition step of acquiring the pluralityof update programs based on the reprogramming information, a commandacquisition step of acquiring the install command information, and awriting step of writing the acquired plurality of update programs intoeach of the plurality of control devices based on the install commandinformation.

In an update terminal in a dealer or a maintenance shop that performsupdate work of programs in the vehicle control device through a wiredconnection, it is not necessary to store the update programs and theinstall command in the nonvolatile recording medium. This can reduce thesecurity risks such as leakage of the update programs and installcommand, the reverse engineering, and the like. This produces anadvantageous effect that the latest install command can be easilydeveloped without changing the software for updating the update terminalon the market, whereby the update work can be accurately performed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram illustrating program update in a vehicle;

FIG. 2 is a configuration diagram including a reprogramming terminal anda control device of a vehicle;

FIG. 3 is a functional block diagram of the reprogramming terminal;

FIG. 4 is a functional block diagram of a first server; and

FIG. 5 is a flowchart of vehicle program update management.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Hereinafter, embodiments will be described in detail with reference tothe drawings. However, the detailed description more than necessary maybe omitted. For example, detailed description of well-known matters andredundant description on substantially the same configuration may beomitted. This is to avoid an unnecessary redundancy in the followingdescription and to facilitate understanding by those skilled in the art.

Note that the accompanying drawings and the following description areprovided to enable those skilled in the art to fully understand thepresent disclosure and are not intended to limit subject matters ofclaims.

1-1. Configurations of Vehicle Program Update Management SystemAccording to First Embodiment

FIG. 1 is a diagram illustrating program update in a vehicle V. In thecase where the vehicle V supports program update through wirelesscommunication, that is, in the case where a program for a control devicecan be updated through over the air (OTA), an update program isdistributed from a wireless distributor server 30 to the vehicle Vthrough a network N and a base station B, and a program is updated. Atthis time, an update history of the program is managed by a first server5 in association with a vehicle identification number of the vehicle V.

As used herein, the term “vehicle” is referred to as a moving body suchas an automobile or a motorcycle. The moving body may have a drive trainincluding an internal combustion engine using a combustible fuel or maybe driven by the other energy sources such as electric energy stored ina battery and hydrogen energy.

A vehicle program update management system 1 according to the presentembodiment is a vehicle program update management system that performsupdate management for a plurality of programs stored in and executed byeach of a plurality of vehicle control units mounted on the vehicle V,the vehicle program update management system 1 including the firstserver 5 configured to manage a program configuration which is acombination of the plurality of programs, a second server 10 configuredto manage a plurality of update programs for the plurality of programs,and a reprogramming terminal 300 which is a device that is wiredlyconnected to the plurality of control devices to perform informationprocessing for updating the programs. The reprogramming terminal 300includes a maintenance PC (personal computer) 200 and a connectiondevice 50. The connection device 50 may be a vehicle control interface(VCI: on-board fault diagnosis device). Each of the first server 5 andthe second server 10 is an information processing device that processesinformation, provides information, and stores information, andspecifically, may be a computer. The first server 5, the second server10, and the reprogramming terminal 300 exchange information with oneanother through the network N.

In a dealer or a maintenance shop of the vehicle, the program is updatedthrough a wired connection. Also in this case, the update history of theprogram is managed by the first server 5. The maintenance PC 200 and theconnection device 50 are connected to each other through wiredconnection means, specifically through a cable 62, and the connectiondevice 50 and a vehicle control device 100 are connected to each otherthrough the wired connection means, specifically through a cable 61.Specifically, the cable used for the wired connection may be, forexample, a USB cable. Of course, the cable may include an on-boarddiagnostic (OBD) connector generally used when a vehicle and an on-boardfault diagnosis device are connected to each other.

FIG. 2 is a configuration diagram including the reprogramming terminal300 included in the vehicle program update management system 1 accordingto the first embodiment and the vehicle control device 100 of thevehicle V. The reprogramming terminal 300 includes the maintenance PC200 and the connection device 50. The maintenance PC 200 is aninformation processing device including a communication unit 223configured to communicate with the first server 5 and the like throughthe network N, an input unit 224 to which information is to be input, adisplay unit 225 on which information is to be displayed using an imageor the like, a control unit 201 configured to control the entiremaintenance PC 200, and an interface 235 for transmitting and receivinginformation to and from the connection device 50. The control device 201includes a processor 210 configured to perform information processingand a storage unit 220 configured to store information. The storage unit220 includes a volatile storage unit 221 in which memory is lost whenpower supply is interrupted, and a nonvolatile storage unit 222 in whichmemory is stored even when power supply is stopped. The processor 210is, for example, a central processing unit (CPU), and the volatilestorage unit 221 is, for example, a random access memory (RAM). Thenonvolatile storage unit 222 may be, for example, a read only memory(ROM), a hard disk drive (HDD) or a solid state drive (SSD).

The connection device 50 is provided between the reprogramming terminal300 and the vehicle control device 100, and includes a control unit 51configured to perform control, an input unit 55 to which information isto be input, a display unit 54 from which information is to be output,an external interface 53 which is an interface for transmitting andreceiving information to and from the maintenance PC 200, and a vehicleside interface 52 for transmitting and receiving information to and fromthe vehicle control device 100. The connection device 50 may be avehicle control interface (VCI: on-board fault diagnosis device).

The vehicle control device 100 includes a data link coupler (DLC) 121which is a connection connector to be connected with the connectiondevice 50 through the cable 61, a management ECU 110 configured tocontrol individual electronic control units (ECUs) which are informationprocessing devices configured to control respective devices included inthe vehicle V, an input unit 125 to which information is to be input,and an output unit 126 from which information is to be output. The inputunit 125 may be a touch panel in an on-board in-vehicle infotainment(IVI) system. The output unit 126 may be an image display deviceincluded in the IVI or an image display device provided in a meterportion. The output unit 126 may be provided in an instrument panel of adriver's seat, for example. Specifically, the output unit 126 isconfigured as a so-called multi information display (MID) incorporatedin a meter panel. The output unit 126 may include a speaker configuredto output voice. Alternatively, the output unit 126 may include a hazardlamp.

An on-board device 101 includes a plurality of devices mounted on thevehicle, and electronic control units (ECUs) configured to control therespective devices. The on-board device 101 may include, for example, atelematics control unit (TCU) 122 for performing wireless communicationas a device. The on-board device 101 may include an in-vehicleinfotainment (IVI) system 131 configured to provide information to anoccupant of the vehicle, an engine ECU 132 configured to control anengine 152, a shift ECU 133 configured to control a shift device 153, asteering ECU 134 configured to control a steering device 154, and ameter ECU 135 configured to control a meter 155. Each ECU is connectedto the management ECU 110 through a bus 102, to transmit or receiveinformation. Here, the engine 152 means not only a drive train includingan internal combustion engine but also may be a motor electricallydriven.

The IVI system 131 implements its function by executing software(program) SW-IVI 141, the engine ECU 132 implements its function byexecuting software SW-EG 142, the shift ECU 133 implements its functionby executing software SW-SF 143, the steering ECU 134 implements itsfunction by executing software SW-ST 144, and the meter ECU 135implements its function by executing software SW-MT 145. In eachsoftware, a program is updated by the vehicle program update managementsystem 1 through the wired connection using the cable 61.

Each ECU is a computer including, specifically, a processor such as aCPU, and a memory such as a ROM and a solid state drive (SSD) into whichexecuting programs are written, and a RAM configured to temporarilystore data for controlling a device. Specifically, the programs receivedfrom the second server 10 through the maintenance PC 200 are executed bythe ECUs which are computers, whereby the devices included in theon-board device 101 are controlled. Instead of or in addition to theabove-described ECUs, all or some of the above-described ECUs may beeach configured of hardware including one or more electronic circuitcomponents. Detailed operations of the vehicle program update managementsystem 1 will be described with reference to FIG. 5, which will bedescribed later.

FIG. 3 is a functional block diagram of the reprogramming terminal 300.The reprogramming terminal 300 is a computer that is wiredly connectedto the plurality of control devices (ECUs) mounted on the vehicle V toperform information processing for updating a plurality of programsstored in and executed by each of the plurality of control devices. Thereprogramming terminal 300 includes an update information acquisitionunit 231 configured to acquire update information about a plurality ofprograms installed into each of a plurality of control devices, anupdate program acquisition unit 232 configured to acquire a plurality ofupdate programs from the second server 10 that manages the plurality ofupdate programs for the plurality of programs, a command acquisitionunit 233 configured to acquire install command information about acommand for installing the update programs from the first server 5 intothe plurality of control devices, and a writing unit 234 configured towrite the acquired plurality of update programs into each of theplurality of control devices based on the install command information.

FIG. 4 is a functional block diagram of the first server 5. The firstserver 5 is a computer configured to manage a program configurationwhich is a combination of a plurality of programs for executing thefunction of each control device (ECU) in the vehicle control device 100.Specifically, the first server 5 manages a version of each program, toprovide an optimum program configuration for each vehicle V. Note thatthe program configuration may be associated with a vehicleidentification number of each vehicle V. Specifically, the first server5 includes a program configuration management unit 244 configured tomanage a history of a program configuration installed into each ECU inthe vehicle control device 100 to bring the program configuration into astate conforming to the laws. At this time, it is desirable that thefirst server 5 acquires, from the wireless distribution server 30, theinformation about the program configuration of each vehicle, the programconfiguration being updated through the OTA.

The first server 5 acquires update information about the programs of thevehicle V, the update information being acquired from the reprogrammingterminal 300. The first server 5 includes a determination unit 241configured to perform a determination as to the program configurationnecessary for each vehicle V, based on the update information, areprogramming information generation unit 242 configured to generatereprogramming information based on the determination, the reprogramminginformation being information about the update programs necessary forthe vehicle, and an install command generation unit 243 configured togenerate install command information which is information about acommand for installing the update programs into the plurality of controldevices.

Note that the first server 5 is an information processing device orcomputer including a processor configured to perform informationprocessing, and a storage unit configured to store information, and thefirst server 5 is connected to the wireless distributor server 30, thesecond server 10, and the reprogramming terminal 300 through the networkN to transmit and receive the information. The second server 10 is alsoa similar information processing device or computer. The second server10 is a computer configured to store and manage a plurality of updateprograms for the plurality of programs for executing functions of thecontrol devices (ECUs) included in the on-board device 101. Operationsof the first server 5, the second server 10, and the reprogrammingterminal 300 in the vehicle program update management system 1 will bedescribed in detail with reference to FIG. 5, which will be describedlater.

1-2. Operations of Vehicle Program Update Management System

FIG. 5 is a flowchart of program update management by the vehicleprogram update management system 1 according to the first embodiment.

In the case where a person who performs update work of programs issuesan instruction to perform program update from the input unit 224 or theinput unit 55 in the reprogramming terminal 300, the reprogrammingterminal 300 issues an update information request to the vehicle controldevice 100 of the vehicle V, to make a request to transmit the updateinformation about the plurality of programs installed into each of thecontrol devices (step S1). The vehicle control device 100 that hasreceived the update information request transmits the update informationabout each program to the reprogramming terminal 300. Then, thereprogramming terminal 300 transmits the acquired update information tothe first server 5 (step S2). The first server 5 manages the acquiredupdate information in association with the vehicle identification numberin the program configuration management unit 244. Specifically, thefirst server 5 stores the update history of the programs.

Next, in the first server 5, the determination unit 241 performs thedetermination as to the program configuration of programs to be updated,the program configuration being necessary for the vehicle V. Then, thereprogramming information generation unit 242 generates reprogramminginformation based on the determination, the reprogramming informationbeing information about the update programs necessary for the vehicle V(step S3). Specifically, the vehicle V may generate a list of updateprograms necessary for program update. Next, the first server 5transmits the reprogramming information to the reprogramming terminal300. The reprogramming terminal 300 that has acquired the reprogramminginformation issues an update program request to the second server 10based on the reprogramming information (step S4). The second server 10transmits, to the reprogramming terminal 300, the update programs inresponse to the update program request of the reprogramming terminal300.

In the first server 5, the install command generation unit 243 generatesinstall command information which is information about a command forinstalling the update programs into the plurality of control devices ofthe vehicle V (step S5). Then, the first server 5 transmits the installcommand information to the reprogramming terminal 300. In thereprogramming terminal 300, the update program acquisition unit 232acquires the update programs. In addition, in the reprogramming terminal300, the command acquisition unit 233 acquires the install commandinformation. Then, in the reprogramming terminal 300, the writing unit234 writes the update programs into each control device of the vehiclecontrol device 100, based on the install command information.

At this time, the reprogramming terminal 300 stores the install commandinformation and the update programs in the volatile storage unit 221,but does not store them in the nonvolatile storage unit 222. Through theabove-described operations, the reprogramming terminal 300 implementsthe program update for the vehicle control device 100 in the vehicle V.

2-1. Configuration of Reprogramming Terminal According to SecondEmbodiment

A reprogramming terminal 300 according to a second embodiment is adevice that is wiredly connected to a plurality of control devices(ECUs) mounted on a vehicle V to perform information processing forupdating a plurality of programs stored in and executed by each of theplurality of control devices. The reprogramming terminal 300 includes anupdate information acquisition unit 231 configured to acquire updateinformation about a plurality of programs installed into each of theplurality of control devices, an update program acquisition unit 232configured to acquire a plurality of update programs from a secondserver 10 that manages the plurality of update programs for theplurality of programs, a command acquisition unit 233 configured toacquire install command information about a command for installing theupdate programs from a first server into the plurality of controldevices, and a writing unit 234 configured to write the acquiredplurality of update programs into each of the plurality of controldevices based on the install command information. A physicalconfiguration of the reprogramming terminal 300 is similar to aconfiguration of the reprogramming terminal 300 included in the vehicleprogram update management system 1 according to the first embodiment,and hence detailed description is omitted (see FIG. 2).

2-2. Operations of Reprogramming Terminal

Operations of the reprogramming terminal 300 according to the secondembodiment are similar to the operations of the reprogramming terminal300 included in the vehicle program update management system 1 accordingto the first embodiment (see FIG. 5), and hence detailed description isomitted.

3. Program Update Management Method According to Third Embodiment

A program update management method according to a third embodiment is avehicle program update management method that performs update managementfor a plurality of programs stored in and executed by each of aplurality of control devices mounted on a vehicle V, the methodincluding a first step of managing a program configuration which is acombination of the plurality of programs, a second step of managing aplurality of update programs for the plurality of programs, and areprogramming step of causing a device wiredly connected to theplurality of control devices to perform information processing forupdating the programs, wherein the reprogramming step includes an updateinformation acquisition step of acquiring, from the vehicle, updateinformation about the plurality of programs installed into each of theplurality of control devices mounted on the vehicle, the first stepincludes a determination step of determining the program configurationnecessary for the vehicle based on the update information, areprogramming information generation step of generating reprogramminginformation which is information about the update programs necessary forthe vehicle, based on the determination, and an install commandgeneration step of generating install command information which isinformation about a command for installing the update programs into theplurality of control devices, and the reprogramming step furtherincludes an update program acquisition step of acquiring the pluralityof update programs based on the reprogramming information, a commandacquisition step of acquiring the install command information, and awriting step of writing the acquired plurality of update programs intoeach of the plurality of control devices based on the install commandinformation.

4. Other Embodiments

In the above-described embodiments, an example has been described inwhich installation of the update programs on the individual controldevices (ECUs) is performed by the writing unit 234 of the reprogrammingterminal 300, but the installation may be performed by the first server5. At this time, it is also conceivable that an operation of acquiringthe update programs from the second server 10 is performed by the firstserver 5. As another modification, the management ECU 110 of the vehiclecontrol device 100 may acquire and write the update programs. In thiscase, the reprogramming terminal 300 may simply transmit and receive theinformation without storing the install command information and theupdate programs.

5. Configurations Supported by Above-Described Embodiments

The above-described embodiments support the following configurations.

(Configuration 1) A vehicle program update management system 1 thatperforms update management for a plurality of programs stored in andexecuted by each of a plurality of control devices mounted on a vehicle,the vehicle program update management system including a first server 5configured to manage a program configuration which is a combination ofthe plurality of programs, a second server 10 configured to manage aplurality of update programs for the plurality of programs, and areprogramming terminal 300 that is wiredly connected to the plurality ofcontrol devices to perform information processing for updating theprograms, wherein the reprogramming terminal 300 includes an updateinformation acquisition unit 231 configured to acquire, from the vehicleV, update information about the plurality of programs installed intoeach of the plurality of control devices mounted on the vehicle V, thefirst server 5 includes a determination unit 241 configured to determinethe program configuration necessary for the vehicle based on the updateinformation, a reprogramming information generation unit 242 configuredto generate reprogramming information which is information about theupdate programs necessary for the vehicle, based on the determination,and an install command generation unit 243 configured to generateinstall command information which is information about a command forinstalling the update programs into the plurality of control devices,and the reprogramming terminal 300 further includes an update programacquisition unit 232 configured to acquire the plurality of updateprograms from the second server 10 based on the reprogramminginformation, a command acquisition unit 233 configured to acquire theinstall command information, and a writing unit 234 configured to writethe acquired plurality of update programs into each of the plurality ofcontrol devices based on the install command information.

According to the vehicle program update management system according toconfiguration 1, all of writing software conventionally stored orinstalled in a PC for performing update work and programs for generatinga writing command are arranged in the external server, whereby the riskssuch as reverse engineering and analysis can be reduced. This makes itunnecessary to perform work of updating the software for updating theprograms on the market, whereby the latest update command can be appliedas necessary. Furthermore, the program update history for each vehiclecan be properly managed.

(Configuration 2) The vehicle program update management system accordingto configuration 1, wherein at least one of the program configuration,the update program, and the install command information is stored in avolatile storage unit 221 included in the reprogramming terminal 300 andis not stored in a nonvolatile storage unit 222 included in thereprogramming terminal 300.

According to the vehicle program update management system ofconfiguration 2, the programs and command can be written into thecontrol devices of the vehicle as in-memory processing on the volatilememory. The programs and command information are not stored on thenonvolatile recording medium such as HDD and SDD on the market, whichmakes it possible to reduce the risks of leakage of confidentialinformation.

(Configuration 3) A reprogramming terminal which is a device that iswiredly connected to a plurality of control devices mounted on a vehicleto perform information processing for updating a plurality of programsstored in and executed by each of the plurality of control devices, thereprogramming terminal including an update information acquisition unit231 configured to acquire update information about the plurality ofprograms installed into each of the plurality of control devices, anupdate program acquisition unit 232 configured to acquire a plurality ofupdate programs from a second server 10 that manages the plurality ofupdate programs for the plurality of programs, a command acquisitionunit 233 configured to acquire, from a first server 5, install commandinformation about a command for installing the update programs into theplurality of control devices, the first server 5 managing a programconfiguration which is a combination of the plurality of programs, and awriting unit 234 configured to write the acquired plurality of updateprograms into each of the plurality of control devices based on theinstall command information.

According to the reprogramming terminal according to configuration 3,all of writing software conventionally stored or installed in a PC forperforming update work and programs for generating a writing command arearranged in the external server, whereby the risks such as reverseengineering and analysis can be reduced. This makes it unnecessary toperform work of updating the software for updating the programs on themarket, whereby the latest update command can be applied as necessary.Furthermore, the program update history for each vehicle can be properlymanaged.

(Configuration 4) A vehicle program update management method thatperforms update management for a plurality of programs stored in andexecuted by each of a plurality of control devices mounted on a vehicle,the method including a first step of managing a program configurationwhich is a combination of the plurality of programs, a second step ofmanaging a plurality of update programs for the plurality of programs,and a reprogramming step of causing a device wiredly connected to theplurality of control devices to perform information processing forupdating the programs, wherein the reprogramming step includes an updateinformation acquisition step of acquiring, from the vehicle, updateinformation about the plurality of programs installed into each of theplurality of control devices mounted on the vehicle, the first stepincludes a determination step of determining the program configurationnecessary for the vehicle based on the update information, areprogramming information generation step of generating reprogramminginformation which is information about the update programs necessary forthe vehicle, based on the determination, and an install commandgeneration step of generating install command information which isinformation about a command for installing the update programs into theplurality of control devices, and the reprogramming step furtherincludes an update program acquisition step of acquiring the pluralityof update programs based on the reprogramming information, a commandacquisition step of acquiring the install command information, and awriting step of writing the acquired plurality of update programs intoeach of the plurality of control devices based on the install commandinformation.

According to the vehicle program update management method according toconfiguration 4, all of writing software conventionally stored orinstalled in a PC for performing update work and programs for generatinga writing command are arranged in the external server, whereby the riskssuch as reverse engineering and analysis can be reduced. This makes itunnecessary to perform work of updating the software for updating theprograms on the market, whereby the latest update command can be appliedas necessary. Furthermore, the program update history for each vehiclecan be properly managed.

The embodiments have been described as exemplifications of thetechniques disclosed in the present application. However, the techniquesin the present disclosure are not limited thereto, and are alsoapplicable to embodiments in which modifications, replacements,additions, omissions and the like are made. Additionally, theconstituent elements described in the above-described embodiments can becombined to provide a new embodiment.

For example, step units of control operations illustrated in FIG. 5 areclassified according to main processing contents to facilitate theunderstanding of operation of each unit of the vehicle program updatemanagement system 1 and the present invention is never limited by theway how to divide the processing units or the names. The step units ofoperation may be divided into still more step units according to theprocessing contents. The step units of operation may be divided suchthat one step unit includes still more processes. The order of steps maybe switched around as appropriate without departing from the sprit andscope of the present invention.

REFERENCE SIGNS LIST

-   1 Vehicle program update management system-   5 First server-   10 Second server-   30 Wireless distribution server-   50 Connection device-   51 Control unit-   52 Vehicle side interface-   53 External interface-   54 Display unit-   55 Input unit-   61 Cable-   62 Cable-   100 Vehicle control device-   101 On-board device-   102 Bus-   110 Management ECU-   121 DLC-   122 TCU-   123 GPS unit-   124 USB connector-   125 Input unit-   126 Output unit-   131 IVI system-   133 Shift ECU-   134 Steering ECU-   135 Meter ECU-   141 SW-IVI-   142 SW-EG-   143 SW-SF-   144 SW-ST-   145 SW-MT-   152 Engine-   153 Shift device-   154 Steering device-   155 Meter-   200 Maintenance PC-   201 Control unit-   210 Processor-   220 Storage unit-   221 Volatile storage unit-   222 Nonvolatile storage unit-   223 Communication unit-   224 Input unit-   225 Display unit-   231 Update information acquisition unit-   232 Update program acquisition unit-   233 Command acquisition unit-   234 Writing unit-   235 Interface-   241 Determination unit-   242 Reprogramming information generation unit-   243 Install command generation unit-   244 Program configuration management unit-   300 Reprogramming terminal-   B Base station-   V Vehicle-   N Communication network

What is claimed is:
 1. A vehicle program update management system thatperforms update management for a plurality of programs stored in andexecuted by each of a plurality of ECUs mounted on a vehicle, theplurality of ECUs each being provided with an ECU processor and an ECUmemory, the vehicle program update management system comprising: a firstserver configured to manage a program configuration which is acombination of the plurality of programs; a second server configured tomanage a plurality of update programs for the plurality of programs; anda reprogramming terminal which is a device that is wiredly connected tothe plurality of ECUs to perform information processing for updating theprograms, wherein the reprogramming terminal includes: a terminalprocessor configured to acquire, from the vehicle, update informationabout the plurality of programs installed into each of the plurality ofECUs mounted on the vehicle, the first server includes: a first serverprocessor configured to: determine the program configuration necessaryfor the vehicle based on the update information; generate reprogramminginformation which is information about the update programs necessary forthe vehicle, based on the determination; and generate install commandinformation which is information about a command for installing theupdate programs into the plurality of ECUs, and the terminal processorof the reprogramming terminal is further configured to: acquire theplurality of update programs from the second server based on thereprogramming information; acquire the install command information; andwrite the acquired plurality of update programs into each of theplurality of ECUs based on the install command information.
 2. Thevehicle program update management system according to claim 1, whereinat least one of the program configuration, the update program, and theinstall command information is stored in a volatile storage unitincluded in the reprogramming terminal and is not stored in anonvolatile storage unit included in the reprogramming terminal.
 3. Areprogramming terminal which is a device that is wiredly connected to aplurality of ECUs mounted on a vehicle, the plurality of ECUs each beingprovided with an ECU processor and an ECU memory, to perform informationprocessing for updating a plurality of programs stored in and executedby each of the plurality of ECUs, the reprogramming terminal comprising:a terminal processor configured to: acquire update information about theplurality of programs installed into each of the plurality of ECUs;acquire a plurality of update programs from a second server that managesthe plurality of update programs for the plurality of programs; acquire,from a first server, install command information about a command forinstalling the update programs into the plurality of ECUs, the firstserver managing a program configuration which is a combination of theplurality of programs; and write the acquired plurality of updateprograms into each of the plurality of ECUs based on the install commandinformation.
 4. A vehicle program update management method that performsupdate management for a plurality of programs stored in and executed byeach of a plurality of ECUs mounted on a vehicle, the plurality of ECUseach provided with an ECU processor and an ECU memory, the methodcomprising: a first step of managing a program configuration which is acombination of the plurality of programs; a second step of managing aplurality of update programs for the plurality of programs; and areprogramming step of causing a device wiredly connected to theplurality of ECUs to perform information processing for updating theprograms, wherein the reprogramming step includes: an update informationacquisition step of acquiring, from the vehicle, update informationabout the plurality of programs installed into each of the plurality ofECUs mounted on the vehicle, the first step includes: a determinationstep of determining the program configuration necessary for the vehiclebased on the update information; a reprogramming information generationstep of generating reprogramming information which is information aboutthe update programs necessary for the vehicle, based on thedetermination; and an install command generation step of generatinginstall command information which is information about a command forinstalling the update programs into the plurality of ECUs, and thereprogramming step further includes: an update program acquisition stepof acquiring the plurality of update programs based on the reprogramminginformation; a command acquisition step of acquiring the install commandinformation; and a writing step of writing the acquired plurality ofupdate programs into each of the plurality of ECUs based on the installcommand information.